Go/github.com/sigstore/timestamp-authority/v2 CVE-2026-39984: medium 5.5, EPSS 0.11%

Sigstore Timestamp Authority has Improper Certificate Validation in verifier

Action: Upgrade github.com/sigstore/timestamp-authority/v2 to 2.0.6 or later.

go get github.com/sigstore/timestamp-authority/v2@v2.0.6

Affected

Fixed versions

Sources

• osv: GHSA-xm5m-wgh2-rrg3
• https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-xm5m-wgh2-rrg3
• https://nvd.nist.gov/vuln/detail/CVE-2026-39984
• https://github.com/sigstore/timestamp-authority
• https://github.com/sigstore/timestamp-authority/releases/tag/v2.0.6

CVE-2026-39984 · published 2026-04-14T01:01:59Z · modified 2026-09-10T03:50:44.895516756Z · JSON